AI Security

Disclosure: Some links below are affiliate links. If you sign up through them, I may earn a commission at no extra cost to you. Vultr — starts at $6/mo DigitalOcean — $200 credit for new users Here’s a question I haven’t seen anyone ask about AI coding agents: what happens when the model is wrong — not just bad code, but malicious? Every agentic tool today — Cursor, Claude Code, Codex, OpenCode — works the same way: the model proposes an action, and the tool trusts it. Maybe it asks for confirmation before running shell commands. But the model picks which commands to run. The model chooses which files to read. The model decides which npm packages to install. The model holds the keys. ...

Ever downloaded a Claude Code skill or a Codex CLI extension without checking what it actually does? Yeah, me too. We all do. But here’s the thing — a recent study found 26.1% of agent skills contain security vulnerabilities, and 5.2% are outright malicious. I’ve seen the AI supply chain problem get real before. Still, that’s not a theoretical risk. So that’s roughly one in four skills carrying a security risk. ...